Privacy Policy
Last updated: August 1, 2026 (v2026-08)
Data controller
The controller that decides the purposes and means of processing your personal data is:
Rickyshor · email: hi@ricky.md
For any question about your data, contact us at hi@ricky.md.
What data we process
Depending on how you use the service, we may process the following categories of data:
- Account data: name, email address, one-time access code (OTP), avatar
- Photographs that may show identifiable people
- People tags on photos (name + manually marked area)
- Messages and details submitted through the contact / booking form
- Push notification subscriptions (device identifier)
- Technical data: IP address, device type, access logs
Legal bases and purposes
- performance of a contract or pre-contractual steps (account creation, delivering services and photos)
- your consent (audience statistics, some notifications, people tagging)
- legitimate interest (service security, abuse prevention, product improvement)
- legal obligations (accounting, responding to authority requests)
Processors and transfers
We use service providers (processors) that process data on our behalf and only on our instructions:
| Provider | Purpose | Location | Transfer |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting and storage | EU (Germany) | No |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (access codes, notifications) | USA | Yes |
| Cloudflare, Inc. | Anti-bot protection (Turnstile) on forms | USA / EU | Yes |
| Google Ireland Ltd (Google Analytics) | Audience statistics (consent-gated only) | EU / USA | Yes |
| Anthropic PBC | AI assistant for the contact form (processes conversation messages) | USA | Yes |
Some of these are located outside the Republic of Moldova. In those cases we ensure appropriate safeguards (standard contractual clauses or an equivalent mechanism).
How long we keep data
| Data category | Period |
|---|---|
| Account data | For the lifetime of the account; deleted 30 days after account closure |
| Gallery photographs | For the duration of the contract and delivery, then per the agreement with the client |
| Unfinished drafts (anonymous) | Deleted automatically after an inactivity period |
| Contact-form messages | Up to 24 months from the last interaction |
| Technical logs | Up to 12 months |
Your rights
Under personal data protection law, you have:
- the right to access your data
- the right to rectify inaccurate data
- the right to erasure (the right to be forgotten)
- the right to restrict processing
- the right to data portability
- the right to object to processing
- the right to lodge a complaint with the supervisory authority
You can exercise your rights by writing to hi@ricky.md or via the "Personal data" page. We respond within 30 days.
Security
We apply technical and organizational measures to protect data against unauthorized access, loss or disclosure. In the event of a security incident that risks your rights, we notify the authority and, where relevant, the affected individuals.
Supervisory authority
You have the right to lodge a complaint with the National Center for Personal Data Protection of Moldova (CNPDCP) (https://datepersonale.md).